fix(security): drop hardcoded CORS '*' + sanitize error responses - #19
Merged
Merged
Conversation
…ugh safeErrorMessage [P1] json() helper and /api/brief text path both hardcoded Access-Control-Allow-Origin: * (plus Allow-Methods/Allow-Headers), overriding the strict extension allowlist in cors.ts. Removed those headers from json() and the brief writeHead so applyCorsHeaders() is the single CORS source of truth (already called at handleRequest entry). [P1] catch-all 500 in handleRequest and readRecent catch in hooks.ts returned String(err)/(e as Error).message directly, leaking DB paths and SQLite fragments. Routed both through safeErrorMessage() from src/lib/api/safe-error-message.ts; raw error logged server-side via console.error with correlationId for debuggability. Build: tsc clean. Files touched: src/api-server.ts, src/api/hooks.ts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Verified pre-launch security fixes (review swarm lane 2).
json()and the/api/briefpath hardcodedAccess-Control-Allow-Origin: *, overriding the strict allowlist incors.ts→ any website could read the local127.0.0.1:18802/api/*(health/KG/reflect data). Removed the hardcoded CORS;applyCorsHeaders()(called before routing) is now the single source of truth, still covering the extension caller.hooks.tsreturned raw error strings (leaking the DB file path). Now routed through the existingsafeErrorMessage()(sanitized message + correlationId; raw error logged server-side).Build clean.